similar to: [PATCH] virtio_ring: use u32 for virtio_max_dma_size

On Wed, 10 May 2023 10:54:37 +0800, zhenwei pi <pizhenwei at bytedance.com> wrote: > Both split ring and packed ring use 32bits to describe the length of > a descriptor: see struct vring_desc and struct vring_packed_desc. > This means the max segment size supported by virtio is U32_MAX. > > An example of virtio_max_dma_size in virtio_blk.c: > u32 v, max_size; > >

On Wed, May 10, 2023 at 11:26:54AM +0800, Xuan Zhuo wrote: > On Wed, 10 May 2023 10:54:37 +0800, zhenwei pi <pizhenwei at bytedance.com> wrote: > > Both split ring and packed ring use 32bits to describe the length of > > a descriptor: see struct vring_desc and struct vring_packed_desc. > > This means the max segment size supported by virtio is U32_MAX. > > >

On Wed, May 10, 2023 at 10:54:37AM +0800, zhenwei pi wrote: > Both split ring and packed ring use 32bits to describe the length of > a descriptor: see struct vring_desc and struct vring_packed_desc. > This means the max segment size supported by virtio is U32_MAX. > > An example of virtio_max_dma_size in virtio_blk.c: > u32 v, max_size; > > max_size =

On Wed, May 10, 2023 at 11:44?AM Michael S. Tsirkin <mst at redhat.com> wrote: > > On Wed, May 10, 2023 at 11:26:54AM +0800, Xuan Zhuo wrote: > > On Wed, 10 May 2023 10:54:37 +0800, zhenwei pi <pizhenwei at bytedance.com> wrote: > > > Both split ring and packed ring use 32bits to describe the length of > > > a descriptor: see struct vring_desc and struct

On Wed, May 10, 2023 at 10:54:37AM +0800, zhenwei pi wrote: > Both split ring and packed ring use 32bits to describe the length of > a descriptor: see struct vring_desc and struct vring_packed_desc. > This means the max segment size supported by virtio is U32_MAX. > > An example of virtio_max_dma_size in virtio_blk.c: > u32 v, max_size; > > max_size =

On 22/07/2019 15:55, Eric Auger wrote: > Do not call dma_max_mapping_size for devices that have no DMA > mask set, otherwise we can hit a NULL pointer dereference. > > This occurs when a virtio-blk-pci device is protected with > a virtual IOMMU. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Signed-off-by: Eric Auger <eric.auger at

On 22/07/2019 15:55, Eric Auger wrote: > Do not call dma_max_mapping_size for devices that have no DMA > mask set, otherwise we can hit a NULL pointer dereference. > > This occurs when a virtio-blk-pci device is protected with > a virtual IOMMU. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Signed-off-by: Eric Auger <eric.auger at

When running a guest featuring a virtio-blk-pci protected with a virtual IOMMU we hit a NULL pointer dereference. This series removes the dma_max_mapping_size() call in virtio_max_dma_size when the device does not have any dma_mask set. A check is also added to early return in dma_addressing_limited() if the dma_mask is NULL. Eric Auger (2): dma-mapping: Protect dma_addressing_limited against

On Mon, Jul 22, 2019 at 04:55:09PM +0200, Eric Auger wrote: > Do not call dma_max_mapping_size for devices that have no DMA > mask set, otherwise we can hit a NULL pointer dereference. > > This occurs when a virtio-blk-pci device is protected with > a virtual IOMMU. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Signed-off-by: Eric Auger

On Mon, Jul 22, 2019 at 04:55:09PM +0200, Eric Auger wrote: > Do not call dma_max_mapping_size for devices that have no DMA > mask set, otherwise we can hit a NULL pointer dereference. > > This occurs when a virtio-blk-pci device is protected with > a virtual IOMMU. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Signed-off-by: Eric Auger

The following codes have an implicit conversion from size_t to u32: (u32)max_size = (size_t)virtio_max_dma_size(vdev); This may lead overflow, Ex (size_t)4G -> (u32)0. Once virtio_max_dma_size() has a larger size than U32_MAX, use U32_MAX instead. Signed-off-by: zhenwei pi <pizhenwei at bytedance.com> --- drivers/block/virtio_blk.c | 4 +++- 1 file changed, 3 insertions(+), 1

Hi, On 7/23/19 5:38 PM, Christoph Hellwig wrote: > On Mon, Jul 22, 2019 at 04:36:09PM +0100, Robin Murphy wrote: >>> diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c >>> index c8be1c4f5b55..37c143971211 100644 >>> --- a/drivers/virtio/virtio_ring.c >>> +++ b/drivers/virtio/virtio_ring.c >>> @@ -262,7 +262,7 @@ size_t

Hi, On 7/23/19 5:38 PM, Christoph Hellwig wrote: > On Mon, Jul 22, 2019 at 04:36:09PM +0100, Robin Murphy wrote: >>> diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c >>> index c8be1c4f5b55..37c143971211 100644 >>> --- a/drivers/virtio/virtio_ring.c >>> +++ b/drivers/virtio/virtio_ring.c >>> @@ -262,7 +262,7 @@ size_t

Hi, here is the next version of this patch-set. Previous versions can be found here: V1: https://lore.kernel.org/lkml/20190110134433.15672-1-joro at 8bytes.org/ V2: https://lore.kernel.org/lkml/20190115132257.6426-1-joro at 8bytes.org/ V3: https://lore.kernel.org/lkml/20190123163049.24863-1-joro at 8bytes.org/ V4: https://lore.kernel.org/lkml/20190129084342.26030-1-joro at 8bytes.org/

Do not call dma_max_mapping_size for devices that have no DMA mask set, otherwise we can hit a NULL pointer dereference. This occurs when a virtio-blk-pci device is protected with a virtual IOMMU. Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") Signed-off-by: Eric Auger <eric.auger at redhat.com> Suggested-by: Christoph Hellwig <hch at lst.de> ---

Add const to make the read-only pointer parameters clear, similar to many existing functions. Use `container_of_const` to implement `to_vvq`, which ensures the const-ness of read-only parameters and avoids accidental modification of their members. Signed-off-by: Feng Liu <feliu at nvidia.com> Reviewed-by: Jiri Pirko <jiri at nvidia.com> --- v0 -> v1 feedbacks from Michael S.

On Mon, Jul 22, 2019 at 04:55:09PM +0200, Eric Auger wrote: > Do not call dma_max_mapping_size for devices that have no DMA > mask set, otherwise we can hit a NULL pointer dereference. > > This occurs when a virtio-blk-pci device is protected with > a virtual IOMMU. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Signed-off-by: Eric Auger

On Mon, Jul 22, 2019 at 04:36:09PM +0100, Robin Murphy wrote: >> diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c >> index c8be1c4f5b55..37c143971211 100644 >> --- a/drivers/virtio/virtio_ring.c >> +++ b/drivers/virtio/virtio_ring.c >> @@ -262,7 +262,7 @@ size_t virtio_max_dma_size(struct virtio_device *vdev) >> { >> size_t

On Tue, Jul 23, 2019 at 05:38:51PM +0200, Christoph Hellwig wrote: > On Mon, Jul 22, 2019 at 04:36:09PM +0100, Robin Murphy wrote: > >> diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c > >> index c8be1c4f5b55..37c143971211 100644 > >> --- a/drivers/virtio/virtio_ring.c > >> +++ b/drivers/virtio/virtio_ring.c > >> @@ -262,7

A bug can be easily reproduced: Host# cat guest-agent.xml <channel type="unix"> <source mode="bind" path="/var/lib/libvirt/qemu/stretch.agent"/> <target type="virtio" name="org.qemu.guest_agent.0" state="connected"/> </channel> Host# virsh attach-device instance guest-agent.xml Host# virsh detach-device